Threats tagged 'ghsa-v6r2-jh58-xx6w'

OpenClaw CLI versions prior to 2026.5.18 contain a vulnerability where marketplace runtime extension metadata can redirect runtime loading to unscanned payloads. This allows a package selected by a trusted operator to load plugin code outside the reviewed package entry points. The vulnerability depends on the operator's configuration and whether lower-trust input can reach the affected feature. A fix is available in version 2026.5.18.